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AMENDMENTS TO THE CLAIMS 

This listing of claims replaces all prior versions and listings of claims in the 
application: 

Listing of claims: 
l.-ll. (Cancelled) 

12. (New) A method for classifying connections detected between senders and 
receivers in communication networks using protocols each designated by a user protocol 
name, said method being performed by means of a computing system and including, 
operated by said computing system: 

recognizing determinant information on the protocol designated by said name, 

from among information conveyed in a detected cormection, by a protocol 
self-identifier mechanism associated with each implicit and explicit used 
protocol name and devised to recognize said determinant information; 
establishing a non-empty or empty list of potentially used protocol names referred 
to as list of son protocol names, with said non-empty or empty list being 
associated with each used protocol name, referred to as father protocol; 
and for each detected connection, by a computing kernel operated by said 
computing system; 

associating to each detected connection a first data structure devised so as to 

contain an ordered sequence of used protocol names which is initialized 
with a so-called base protocol name; 
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constmcting said first data structure by searching, throughout said list of son 

protocol names associated with the last name of said ordered sequence, by 
discriminating between implicit and explicit son protocol name, for a son 
protocol name for which said associated self-identifier mechanism 
recognizes determinant information from among said conveyed 
information and then by appending to the end of said ordered sequence 
said son protocol name when it is found and by startmg the search again 
otherwise, so long as it is possible to find in said list of son protocol names 
which is associated with the last name of said ordered sequence, a son 
protocol name for which said associated self-identifier mechanism 
recognizes determinant information from among said conveyed 
information; and 

declaring said detected connection as being classified when it is no longer 

possible to find, in said list of son protocol names associated with the last 
name of said ordered sequence, a son protocol name for which said 
associated self-identifier mechanism recognizes determinant information 
from among said conveyed information. 

13. (New) The method of claim 12, wherein said searching for an implicit son 
protocol name includes submitting by means of said computing kernel said conveyed 
information to each self-identifier mechanism associated with a name from said list of 
son protocol names until one of said self-identifier mechanism declares recognition of 
determinant information or until no self-identifier mechanism can declare recognition of 
determinant information. 
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14. (New) The method of claim 12, wherein said searching for an explicit son 
protocol name includes submitting by means of said computmg kernel said conveyed 
information to the self-identifier mechanism associated with the last name of said ordered 
sequence, so as to allow said self-identifier mechanism to fmd said son protocol name 
among the determinant information of said father protocol. 

15. (New) The method of claim 12, including establishmg a current signature for 
each detected connection by said computing kernel, by: 

submitting all or part or said conveyed information to at least one self-identifier 
mechanism associated with one of the names of low rank in said ordered 
sequence; 

finding among the determinant information source and destination mdicators by 

using said self-identifier mechanism; and 
incorporating said source and destination indicators into said current signature. 

16. (New) The method or claim 15, including cataloguing each first data structure in 
a first table by said computing kernel by establishing a first associative correspondence 
between each first data structure and the current signature established for the associated 
coimection. 

17. (New) The method of claim 16, further including establishing by said computing 
kernel in said first table a second associative correspondence between each current 
signature and a peer signature whose source indicators arc the indicators of destination of 
the current signature and whose destination indicators are the source indicators of the 
current signature. 



Applicants 
Serial No. 
Filed 
Page 



Serge Fdida et al. 
10/523,339 
September 1,2005 
7 of 12 



Attorney Docket No.: 35201-002US1 
Client Ref. No.: QT FR03/02075 US 



18. (New) The method of claim 16, further including, operated by said computing 
kernel: 

gathering in data packets passing through said computing system within 

connections to be detected the useful information conveyed so as to 
formulate a signature and thus the current signature whenever the useful 
information conveyed is sufficient; 

using said current signature thus formulated in real time to detect a connection, by 
searching in said first table for the first data structure which corresponds to 
said current signature, associating a new first data structure with said 
detected connection when there exists no first data structure which 
corresponds to said current signature, by starting or continuing to 
construct said first data structure when there exists a first data structure 
which corresponds to said current signature, by gathering in the data 
packets the useful information conveyed so as to construct said first data 
structure. 



19. (New) The method of claim 18, fiarther including when the useful information 
gathered in a data packet is not sufficient to formulate a signature, operated by said 
computing kernel: 

cataloguing the useful mformation m a second table by establishing an associative 
correspondence between the useful information which thus comprises 
links or memberships to one and the same connection, until said useful 
information is sufficient to formulate said current signature. 
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20. (New) The method of claim 12, further including operated by said computing 
kernel: 

reading the used protocol names of said ordered sequence in the data structure the 
computing kernel is building up, so as to detect each dynamic connection 
protocol name; and for each dynamic connection protocol name detected; 

submitting the information conveyed to the self-identifier mechanism associated 
with the name detected so as to determine whether there exists a 
subsequent dynamic connection; and if a subsequent connection exists; 

associating therewith a second data structure devised so as to contain an ordered 
sequence of potential protocol names which begins with said so-called 
base protocol name. 

2 1 . (New) The method of claim 20 further including, operated by said computing 
kernel cataloguing each second data structure m a second table by establishing an 
associative correspondence between each second data structure and a potential signature 
formulated by said self-identifier mechanism associated with the name detected. 

22. (New) The method of claim 21, further including operated by said computing 
kernel: 

searching for the ordered sequences of potential protocol names in which the 
ordered sequence of used protocol names is included; and, when there 
exists an ordered sequence of potential protocol names whose potential 
signature corresponds to said current signature; 

completing said first data structure by means of said second data structure. 



